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CLAIMS 

What is claimed is: 

1 . A method for gathering and monitoring the simultaneous status of nodes in a 
5 storage area network (SAN), comprising: 

receiving alert messages corresponding to status events in the storage area 
network, each status event having a corresponding event category and severity value; 

aggregating the alert messages according to event category and severity value to 
generate a category specific severity ranking of the alert messages; 
10 displaying a status array having a plurality of chart entries, each chart entry 

corresponding to alert messages of a particular event category and each chart entry 
having a node entry for each node having status attributable to the alert messages; and 

displaying, within at least one chart entry, node entries having a status event 
associated with the event category for that chart entry, the node entries displayed in the 
1 5 chart entry according to the severity ranking and each node entry indicative of a severity 
scale of status for the corresponding effected node. 

2. The method of claim 1 wherein displaying, within the at least one chart entry, 
comprises: 

20 accumulating events of each of a plurality of severity levels, wherein the severity 

scale for a node entry is an enumeration of events received for each of the plurality of 
severity levels within the severity ranking; and 

displaying the enumeration for each node entry within the at least one chart entry 
containing that node entry. 

25 

3. The method of claim 2 wherein the enumeration is a histogram having a 
magnitude based on the severity scale and a quantity of events within each severity level 
within the severity ranking. 
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4. The method of claim 3 wherein the histogram has a plurality of visually 
overlapping elongated bar segments, each elongated bar segment corresponding to a 
particular severity level 

5 5. The method of claim 1 further including discovering a topology of nodes in the 
SAN, wherein the alert messages correspond to status events for each of a plurality of 
selected nodes in a selection tree, the selection tree indicative of the nodes in the SAN. 

6. The method of claim 1 further including filtering the status events to compute a 
10 subset of elected events, wherein the received events correspond to elected events 

determined in response to predetermined filtering logic at the agents processing the 
elected events. 

7. The method of claim 1 wherein each chart entry has a magnitude axis, the 

15 magnitude axis indicative of a relative range of the quantity of status events within each 
of the severity levels corresponding to a plurality of node entries reflected in the chart 
entry. 

8. The method of claim 1 wherein each chart entry has a manageable entity axis, the 
20 manageable entity axis arranged, for each node, according to increasing security scale 

denoting the severity ranking for each node included in the chart entry, and further 
comprising computing the severity scale for each node according to a predetermined 
severity metric. 

25 9. The method of claim 1 wherein the severity level corresponds to a threshold 
value, the threshold value identifying triggering of an event having the corresponding 
severity level. 

10. The method of claim 1 wherein each event in an event category has a set of 
30 threshold values, the threshold values indicative of a quantitative metric triggering the 
particular event and severity. 
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1 1 . The method of claim 1 0 further comprising processing and propagating the 
threshold values to remote agents, the remote agents operable to analyze nodes and 
determine when a particular metric satisfying a triggering threshold is attained and 

5 generate the corresponding event. 

12. The method of claim 1 wherein the nodes further comprise manageable entities, 
the manageable entities responsive to the server in a SAN and further including storage 
entities, connectivity entities, and database entities. 

10 

13. The method of claim 1 further comprising selectively suppressing events of a 
particular category and severity. 

14. The method of claim 1 wherein the chart entries in the status array are further 
15 subdivided into chart entries directed to manageable entity health, manageable entity 

performance, and storage system capacity. 

15. The method of claim 1 comprising: 

receiving a selection of at least one node in a hierarchical arrangement of nodes; 

20 and 

wherein receiving, aggregating, displaying a status array, and displaying, within at least 
one chart entry, node entries are performed in relation to the selected at least one node in 
order to display the simultaneous status of nodes in a storage area network. 

25 16. The method of claim 1 wherein: 

the status array is an N by M matrix of the plurality of chart entries, the plurality 
of chart entries including: 

i) a general alert chart entry displaying alert status of managed entities in the 
storage area network; 

30 ii) a storage chart entry indicating alert status of managed storage entities in the 

storage area network; 
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iii) a host chart entry indicating alert status of managed host entities in the storage 
area network; and 

iv) a connectivity chart entry indicating alert status of managed connectivity 
entities in the storage area network. 

5 

17. The method of claim 1 further comprising 

receiving a user input corresponding to selection of at least one node entry from 
among the node entries displayed in the status array; 

displaying an expanded menu of status options for the selected entry; and 
10 receiving a response to the menus of status options and displaying an expanded 

status report corresponding to the expanded menu. 

18. A network monitoring device for gathering and monitoring the simultaneous 
status of nodes in a storage area network (SAN), comprising: 

15 a server having a correlator operable to receive alert messages corresponding to 

status events in the storage area network, each status event having a corresponding event 
category and severity value; 

an aggregator operable to aggregate the alert messages according to event 
category and severity value to generate a category specific severity ranking of the alert 

20 messages; and 

an operator console operable to display a status array having a plurality of chart 
entries, each chart entry corresponding to alert messages of a particular event category 
and each chart entry having a node entry for each node having status attributable to the 
alert messages, the console further operable to display, within at least one chart entry, 

25 node entries having a status event associated with the event category for that chart entry, 
the node entries displayed in the chart entry according to the severity ranking and each 
node entry indicative of a severity scale of status for the corresponding effected node. 

19. The network monitoring device of claim 18 wherein the accumulator is further 
30 operable to: 
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accumulate events of each of a plurality of severity levels, wherein the severity 
scale for a node entry is an enumeration of events received for each of the plurality of 
severity levels within the severity ranking; and 

display, within the at least one chart entry, the enumeration for each node entry 
5 within the at least one chart entry containing that node entry. 

20. The network monitoring device of claim 19 wherein the enumeration is a 
histogram having a magnitude based on the severity scale and a quantity of events within 
each severity level within the severity ranking. 

10 

21 . The network monitoring device of claim 20 wherein the histogram has a plurality 
of visually overlapping elongated bar segments, each elongated bar segment 
corresponding to a particular severity level. 

15 22. The network monitoring device of claim 1 8 wherein the server is further operable 
to discover a topology of nodes in the SAN, wherein the alert messages correspond to 
status events for each of a plurality of selected nodes in a selection tree, the selection tree 
indicative of the nodes in the SAN. 

20 23. The network monitoring device of claim 1 8 wherein the server is further operable 
to filter the status events to compute a subset of elected events, wherein the received 
events correspond to elected events determined in response to predetermined filtering 
logic at the agents processing the elected events. 

25 24. The network monitoring device of claim 18 wherein each chart entry has a 

magnitude axis, the magnitude axis indicative of a relative range of the quantity of status 
events within each of the severity levels corresponding to a plurality of node entries 
reflected in the chart entry. 

30 25. The network monitoring device of claim 1 8 wherein each chart entry has a 

manageable entity axis, the manageable entity axis arranged, for each node, according to 
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increasing security scale denoting the severity ranking for each node included in the chart 
entry, and further comprising computing the severity scale for each node according to a 
predetermined severity metric. 

5 26. The network monitoring device of claim 1 8 wherein the severity level 

corresponds to a threshold value, the threshold value identifying triggering of an event 
having the corresponding severity level. 

27. The network monitoring device of claim 18 wherein each event in an event 

10 category has a set of threshold values, the threshold values indicative of a quantitative 
metric triggering the particular event and severity. 

28. The network monitoring device of claim 27 wherein the server is further operable 
to processing and propagating the threshold values to remote agents, the remote agents 

15 operable to analyze nodes and determine when a particular metric satisfying a triggering 
threshold is attained and generate the corresponding event. 

29. The network monitoring device of claim 1 8 wherein the nodes further comprise 
manageable entities, the manageable entities responsive to the server in a SAN and 

20 further including storage entities, connectivity entities, and database entities. 

30. The network monitoring device of claim 1 8 wherein the server is operable to 
selectively suppress events of a particular category and severity. 

25 31. The network monitoring device of claim 1 8 wherein the chart entries in the status 
array are further subdivided into chart entries directed to manageable entity health, 
manageable entity performance, and storage system capacity. 

32. The network monitoring device of claim 1 8 wherein the server is further operable 
30 to receive a selection of at least one node in a hierarchical arrangement of nodes, and 
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display, within at least one chart entry, node entries in relation to the selected at least one 
node in order to display the simultaneous status of nodes in a storage area network. 

33. The network monitoring device of claim 18 wherein: 

5 the status array is an N by M matrix of the plurality of chart entries, the plurality 

of chart entries including: 

i) a general alert chart entry displaying alert status of managed entities in the 
storage area network; 

ii) a storage chart entry indicating alert status of managed storage entities in the 
1 0 storage area network; 

iii) a host chart entry indicating alert status of managed host entities in the storage 
area network; and 

iv) a connectivity chart entry indicating alert status of managed connectivity 
entities in the storage area network. 

15 

34. The network monitoring device of claim 18 wherein the server is further operable 
to: 

receive a user input corresponding to selection of at least one node entry from 
among the node entries displayed in the status array; 
20 display an expanded menu of status options for the selected entry; and 

display an expanded status report corresponding to the expanded menu and a 
response to the menu of status options. 

35. A computer program product having a computer readable medium operable to 
25 store computer program logic embodied in computer program code encoded thereon for 

gathering and monitoring the simultaneous status of nodes in a storage area network 
(SAN), comprising: 

computer program code for receiving alert messages corresponding to status 
events in the storage area network, each status event having a corresponding event 
30 category and severity value; 
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computer program code for aggregating the alert messages according to event 
category and severity value to generate a category specific severity ranking of the alert 
messages; 

computer program code for displaying a status array having a plurality of chart 
5 entries, each chart entry corresponding to alert messages of a particular event category 
and each chart entry having a node entry for each node having status attributable to the 
alert messages; and 

computer program code for displaying, within at least one chart entry, node 
entries having a status event associated with the event category for that chart entry, the 
10 node entries displayed in the chart entry according to the severity ranking and each node 
entry indicative of a severity scale of status for the corresponding effected node. 

36. A computer data signal having program code for gathering and monitoring the 
simultaneous status of nodes in a storage area network (SAN), comprising: 

1 5 program code for receiving alert messages corresponding to status events in the 

storage area network, each status event having a corresponding event category and 
severity value; 

program code for aggregating the alert messages according to event category and 
severity value to generate a category specific severity ranking of the alert messages; 
20 program code for displaying a status array having a plurality of chart entries, each 

chart entry corresponding to alert messages of a particular event category and each chart 
entry having a node entry for each node having status attributable to the alert messages; 
and 

program code for displaying, within at least one chart entry, node entries having a 
25 status event associated with the event category for that chart entry, the node entries 
displayed in the chart entry according to the severity ranking and each node entry 
indicative of a severity scale of status for the corresponding effected node. 

37. A network monitoring device for gathering and monitoring the simultaneous 
30 status of nodes in a storage area network (SAN), comprising: 
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means for receiving alert messages corresponding to status events in the storage 
area network, each status event having a corresponding event category and severity 
value; 

means for aggregating the alert messages according to event category and severity 
5 value to generate a category specific severity ranking of the alert messages; 

means for displaying a status array having a plurality of chart entries, each chart 
entry corresponding to alert messages of a particular event category and each chart entry 
having a node entry for each node having status attributable to the alert messages; and 
means for displaying, within at least one chart entry, node entries having a status 
10 event associated with the event category for that chart entry, the node entries displayed in 
the chart entry according to the severity ranking and each node entry indicative of a 
severity scale of status for the corresponding effected node. 



